1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

# Returning from page fault handler (x86-64)
 
.global page_fault_return
page_fault_return:
    # At this point, the C page fault handler has returned
    # Stack contains saved registers from entry
    
    # Restore general-purpose registers
    popq %rax
    popq %rbx
    popq %rcx
    popq %rdx
    popq %rsi
    popq %rdi
    popq %rbp
    popq %r8
    popq %r9
    popq %r10
    popq %r11
    popq %r12
    popq %r13
    popq %r14
    popq %r15
    
    # Skip error code pushed by CPU
    addq $8, %rsp
    
    # Now stack layout is exactly what CPU pushed:
    # [RSP+0]  = RIP  (faulting instruction address)
    # [RSP+8]  = CS   (code segment, CPL in bits 0:1)
    # [RSP+16] = RFLAGS
    # [RSP+24] = RSP  (user stack pointer)
    # [RSP+32] = SS   (stack segment)
    
    # IRETQ pops all of these atomically
    iretq
    
    # After IRETQ:
    # - CPU is in user mode (ring 3)
    # - RIP points to the faulting instruction
    # - All registers are restored
    # - The instruction executes again
    # - This time, page is mapped, so it succeeds!

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

// Conceptual illustration of state preservation
 
struct saved_state {
    // Hardware-saved (on stack, restored by IRET)
    uint64_t rip;     // Points to MOV from example below
    uint64_t cs;      // User code segment
    uint64_t rflags;  // Flags at time of fault
    uint64_t rsp;     // User stack pointer
    uint64_t ss;      // User stack segment
    
    // Software-saved (by entry point, restored before IRET)
    uint64_t rax;     // Value in RAX during fault
    uint64_t rbx;     // etc.
    uint64_t rcx;
    uint64_t rdx;
    uint64_t rdi;
    uint64_t rsi;
    uint64_t rbp;
    uint64_t r8, r9, r10, r11, r12, r13, r14, r15;
};
 
/*
 * Example faulting instruction:
 *   MOV RAX, [RBX + RCX * 8]
 * 
 * At fault time:
 *   RIP = address of this MOV
 *   RBX = 0x1000 (base address of array)
 *   RCX = 5 (index)
 *   Effective address = 0x1000 + 5*8 = 0x1028
 *   
 * Page at 0x1000 is not present → fault
 * 
 * After handling:
 *   Page containing 0x1028 is now mapped
 *   RIP still points to MOV
 *   RBX still = 0x1000
 *   RCX still = 5
 *   
 * Retry:
 *   MOV calculates same address: 0x1028
 *   Translation succeeds this time
 *   RAX gets the value from memory
 *   Execution continues to next instruction
 */
 
// The guarantee: no register was changed
void verify_state_preserved(struct saved_state *before,
                            struct saved_state *after) {
    // Everything should be identical
    assert(before->rax == after->rax);
    assert(before->rbx == after->rbx);
    // ... etc for all registers ...
    
    // RIP points to same instruction
    assert(before->rip == after->rip);
    
    // The ONLY difference: page is now mapped
    // This is invisible to user code
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58

// How REP MOVS handles faults
 
/*
 * Instruction: REP MOVSB
 * 
 * Semantics:
 *   while (RCX != 0) {
 *       [RDI] = [RSI];  // Copy one byte
 *       RSI += direction;
 *       RDI += direction;
 *       RCX--;
 *   }
 * 
 * Problem: What if fault occurs mid-copy?
 * 
 * Solution: RSI, RDI, RCX are updated each iteration.
 * When fault occurs:
 *   - RCX = remaining count
 *   - RSI = next source address
 *   - RDI = next destination address
 * 
 * Restart: REP MOVSB resumes from current RSI/RDI/RCX
 * No work is repeated; no work is skipped.
 */
 
// Example trace:
// Initial: RSI=src, RDI=dst, RCX=1000
// Copy 500 bytes successfully
// Fault on byte 501 (destination page not present)
// At fault: RSI=src+500, RDI=dst+500, RCX=500
// Handle fault: map dst+500 page
// Restart: REP MOVSB with RSI=src+500, RDI=dst+500, RCX=500
// Copies remaining 500 bytes
// Total effect: all 1000 bytes copied
 
/*
 * Compare: CISC vs RISC
 * 
 * CISC (x86): Has complex instructions like REP MOVS
 *   Need elaborate restart logic
 *   Architecture ensures restartability
 * 
 * RISC (ARM, RISC-V): Instructions are simple
 *   Each instruction does one memory access
 *   Restartability is trivial
 *   String copies are loops of simple loads/stores
 */
 
// Pseudo-code for what the CPU does internally
void handle_fault_in_rep_movs(FaultState *state) {
    // CPU has already updated RSI, RDI, RCX to reflect progress
    // The saved state in the interrupt frame has current values
    
    // When we IRET:
    // - RIP points to the REP MOVSB instruction
    // - RSI, RDI, RCX reflect progress made
    // - REP MOVSB will continue from where it left off
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58

// Security aspects of returning to user mode
 
/*
 * IRET performs implicit security checks:
 * 
 * 1. CS.RPL check
 *    - RPL (Requested Privilege Level) in CS must match target ring
 *    - Returning to ring 3: CS.RPL must be 3
 *    - Can't return to kernel (ring 0) from user-originated exception
 * 
 * 2. Segment validity
 *    - CS must reference a valid code segment
 *    - Segment must be present
 *    - Segment must be executable
 * 
 * 3. RFLAGS sanitization
 *    - IOPL (I/O Privilege Level) can only be raised by ring 0
 *    - VM flag (virtual 8086 mode) is restricted
 *    - IF (interrupt flag) behavior varies
 */
 
// What the kernel ensures before IRET
void prepare_return_to_usermode(struct pt_regs *regs) {
    // Ensure CS has user ring (RPL = 3)
    regs->cs = USER_CS | 3;  // USER_CS selector with RPL=3
    
    // Ensure SS has user ring
    regs->ss = USER_DS | 3;
    
    // Sanitize flags
    regs->flags &= FLAG_MASK_USER;  // Clear dangerous bits
    regs->flags |= FLAG_IF;         // Ensure interrupts will be enabled
    
    // SMAP/SMEP: CPU flags that trap kernel access to user memory
    // These are automatically re-enabled on return to user mode
}
 
// After IRETQ completes:
// - Kernel stack is now unused (until next entry)
// - User stack (restored RSP) is active
// - User cannot access kernel memory
// - User code resumes at saved RIP
 
/*
 * If an attacker corrupted the stack:
 * 
 * Scenario: Try to return to kernel address with ring 0
 * 
 *   fake frame: RIP = kernel_function
 *               CS  = USER_CS | 0  // Try CPL 0
 * 
 * Result: CPU rejects this
 *   - CS.RPL (0) != actual CPL requested
 *   - Would need descriptor with DPL 0
 *   - User can't access kernel descriptors
 *   → General Protection Fault (#GP)
 *   → Kernel handles GP, kills malicious process
 */

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

// Handling multiple faults per instruction
 
/*
 * Instruction: MOVS (MOV String)
 *   Source: [RSI]
 *   Destination: [RDI]
 *   May fault on either or both
 * 
 * Execution trace:
 * 1. Attempt to read [RSI]
 *    - Source page not present → fault
 *    - Handle: load source page
 *    - Restart MOVS
 * 
 * 2. Read [RSI] succeeds
 *    Attempt to write [RDI]
 *    - Dest page not present → fault
 *    - Handle: load dest page  
 *    - Restart MOVS
 * 
 * 3. Read [RSI] succeeds (maybe TLB hit now)
 *    Write [RDI] succeeds
 *    MOVS completes
 */
 
// Signal handling interacts with page faults
int resume_user_or_handle_signal(struct pt_regs *regs) {
    // Page fault handling is complete
    // Before returning to user mode, check for pending signals
    
    if (signal_pending(current)) {
        // A signal arrived during fault handling
        // Don't restart faulting instruction yet
        // Instead, set up signal handler frame
        
        struct ksignal ksig;
        get_signal(&ksig);
        handle_signal(&ksig, regs);
        
        // Signal handler will eventually return
        // Then faulting instruction will retry
        // (unless signal was fatal)
    }
    
    // Return to user mode
    return 0;
}
 
// Fault during instruction fetch
// The instruction bytes themselves might be on a not-present page
int handle_instruction_fetch_fault(unsigned long address,
                                    struct pt_regs *regs) {
    // Special case: can't examine the opcode (it's not present!)
    // But we don't need to - same handling as data page fault
    // 
    // address == regs->rip (faulting instruction address)
    // VMA should be executable
    // Load the code page the same as any file-backed page
    
    struct vm_area_struct *vma = find_vma(current->mm, address);
    
    if (!(vma->vm_flags & VM_EXEC)) {
        // Code page must be executable
        // If it's not, this is definitely wrong
        return VM_FAULT_SIGSEGV;
    }
    
    // Handle like normal file-backed fault
    // (code is in executable file)
    return filemap_fault(vmf);
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

// Demonstration of transparency
 
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
 
// This function cannot tell if pages are demand-paged
int sum_array(int *array, size_t n) {
    int sum = 0;
    for (size_t i = 0; i < n; i++) {
        sum += array[i];  // May page fault, but we can't tell
    }
    return sum;  // Correct result regardless
}
 
// This function CAN detect timing differences
void measure_access_time(void *ptr) {
    struct timespec start, end;
    volatile int value;
    
    clock_gettime(CLOCK_MONOTONIC, &start);
    value = *(int *)ptr;  // This access
    clock_gettime(CLOCK_MONOTONIC, &end);
    
    long ns = (end.tv_sec - start.tv_sec) * 1e9 + 
              (end.tv_nsec - start.tv_nsec);
    
    if (ns > 100000) {  // > 100 microseconds
        printf("Likely page fault: %ld ns
", ns);
    } else if (ns > 100) {  // > 100 nanoseconds
        printf("Likely cache miss: %ld ns
", ns);
    } else {
        printf("Cache hit: %ld ns
", ns);
    }
}
 
// Using mincore to check residency (breaks transparency)
#include <sys/mman.h>
 
void check_residency(void *addr, size_t length) {
    size_t page_size = sysconf(_SC_PAGESIZE);
    size_t num_pages = (length + page_size - 1) / page_size;
    unsigned char *vec = malloc(num_pages);
    
    mincore(addr, length, vec);
    
    for (size_t i = 0; i < num_pages; i++) {
        printf("Page %zu: %s
", i, 
               (vec[i] & 1) ? "resident" : "not resident");
    }
    
    free(vec);
}